Researchers detail hard-to-detect malware affecting 140+ banks and other orgs that can be injected directly into computer memory using legitimate system tools
A new Kaspersky report talks about at least 140 banks — Banks, telcos, and even governmental agencies in the United States …
Context & Ripple Effects
Kaspersky's report on memory-resident malware lands mid-arc in a decade-long escalation against financial institutions. The same lab previously documented at least $300M stolen from 100+ banks across 30 nations and an advanced toolkit with 50+ modules running since 2011 against governments and telcos — this report shows the next stage: attacks that leave no malicious file on disk at all.
The technique matters because it targets the blind spot of signature-based antivirus: code injected directly into computer memory using legitimate system tools looks, to most defenses, like normal administration.
First-order effects
- The 140+ affected banks, telcos, and US government agencies face remediation with no artifact to quarantine — incident responders must hunt behavior in process memory rather than scan files.
- Antivirus vendors whose detection model is file signatures are immediately exposed as structurally blind to this class of attack.
Second-order effects
- Banks and telcos are pushed toward behavioral monitoring and memory forensics tooling, shifting security spend from signature updates to endpoint detection that watches how legitimate tools are used.
- Attack groups observing the success of living-off-the-system-tools tactics have less incentive to build custom binaries, lowering the cost of entry for copying the approach against other high-value sectors.
Third-order effects
- If fileless techniques keep proving effective, the industry's baseline assumption — that scanning files is enough — gives way to continuous behavioral telemetry, and regulators scrutinizing bank cyber-defenses will increasingly ask for it.
- The trajectory visible in Kaspersky's own later findings points deeper than memory: toward persistence below the OS, as with malware embedded in UEFI firmware on victims' motherboards, meaning even reimaging machines may not evict future intrusions.
The trend: Financial-sector intrusions are migrating from dropped malware files to attacks that abuse trusted system tools and live in memory, forcing detection to move from signatures to behavior.